Palo Alto - GPVPN - IPSEC b2b

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo Alto - GPVPN - IPSEC b2b

L0 Member

My current role is as a Network Architect and I am working with our security team to get some Palo Alto firewalls setup to provide

GPVPN access and also IPSEC b2b connectivity.


Our initial design has a single external public address to host the GPVPN traffic and the IPSEC b2b traffic and works ok. We are currently discussing the option of implementing a 2nd public address so that we can split the GPVPN and IPSEC b2b traffic on to separate interfaces which seems to make sense.


We are also hearing from the security department that they would like to see each IPSEC b2b tunnel terminated on an individual public IP address which we are going to discuss.


What are your thoughts on this


Option 1 -  Stay with a single public IP to terminate GPVPN and b2b IPSEC tunnels


Option 2-   Have a Public IP for GPVPN and a 2nd Public IP's for "ALL" b2b IPSEC tunnels


Option 3 - Have a Public IP for GPVPN and multiple Public IP's - 1 for each IPSEC tunnel

          20 tunnels - 20 public IP's      50 tunnels - 50 public IP's


I am expecting a lot of people to come back with either option 1 or option 2 but I am interested to see if anyone

thinks option 3 is a good idea.


Cyber Elite
Cyber Elite



Option 2 is what you should be using.


Option 3 is definitely not needed.  Having unique public IP does not provide additional security, only additional option for potential misconfiguration and challenging troubleshooting.


I would be using public IP with loopback addresses vs exposing the true public IP associated with your 2 ethernet interfaces.



Help the community: Like helpful comments and mark solutions

Hi@SCantwell_IM and what will be the benefit of option 2?


@mcroninI would personally go for option 1:

- The other two options bring unnecessary complexity. One public IP for site-to-site and RA VPN is simple and easy to support

- If you enable GP VPN on the same interface that you use for site-to-site or on a separate, you still need to expose it and open the required ports. If it reachable from internet any scanner will detect it and will try to exploit.


I would say Option 1 or 2. Both have advantages and disadvantages. I would say make sure that whatever the internal to external NAT should be different just in case a VPN user does something goofy and get that IP blocked some how it wont affect other services.



  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!